{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/imgtrojan-jailbreaking-vision-language-models","title":"ImgTrojan: Jailbreaking Vision-Language Models with ONE Image","arxiv_id":"2403.02910","date":"2024-03-05","proceeding":null,"authors":["Xijia Tao","Shuai Zhong","Lei LI","Qi Liu","Lingpeng Kong"],"abstract":"There has been an increasing interest in the alignment of large language models (LLMs) with human values. However, the safety issues of their integration with a vision module, or vision language models (VLMs), remain relatively underexplored. In this paper, we propose a novel jailbreaking attack against VLMs, aiming to bypass their safety barrier when a user inputs harmful instructions. A scenario where our poisoned (image, text) data pairs are included in the training data is assumed. By replacing the original textual captions with malicious jailbreak prompts, our method can perform jailbreak attacks with the poisoned images. Moreover, we analyze the effect of poison ratios and positions of trainable parameters on our attack's success rate. For evaluation, we design two metrics to quantify the success rate and the stealthiness of our attack. Together with a list of curated harmful instructions, a benchmark for measuring attack efficacy is provided. We demonstrate the efficacy of our attack by comparing it with baseline methods.","url_abs":"https://arxiv.org/abs/2403.02910v2","url_pdf":"https://arxiv.org/pdf/2403.02910v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"imgtrojan-jailbreaking-vision-language-models","repo_url":"https://github.com/xijia-tao/imgtrojan","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2403.02910","atlas_url":"https://app.syntology.ai/?focus=2403.02910","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2403.02910"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/xijia-tao/imgtrojan","reach":{"status":"ok"}}],"summary":{"ran_draft_wrong":4,"ran":2,"unverified":3},"by_repo_kind":{"official":{"samples":9,"ran":6,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":9,"samples":[{"code_sha256_prefix":"4c1b107103b7c856","entry":"cook_refs","repo":"xijia-tao/imgtrojan","repo_kind":"official","path":"evaluation/caption_accur_metric/script/cider_scorer.py","file_url":"https://github.com/xijia-tao/imgtrojan/blob/HEAD/evaluation/caption_accur_metric/script/cider_scorer.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4c1b107103b7c856"}},{"code_sha256_prefix":"3573c4bc85f65dfd","entry":"cook_test","repo":"xijia-tao/imgtrojan","repo_kind":"official","path":"evaluation/caption_accur_metric/script/cider_scorer.py","file_url":"https://github.com/xijia-tao/imgtrojan/blob/HEAD/evaluation/caption_accur_metric/script/cider_scorer.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"3573c4bc85f65dfd"}},{"code_sha256_prefix":"592b3c1a88f93d7c","entry":"expand2square","repo":"xijia-tao/imgtrojan","repo_kind":"official","path":"finetune/llava/mm_utils.py","file_url":"https://github.com/xijia-tao/imgtrojan/blob/HEAD/finetune/llava/mm_utils.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"592b3c1a88f93d7c"}},{"code_sha256_prefix":"bb945d226af806a7","entry":"load_image","repo":"xijia-tao/imgtrojan","repo_kind":"official","path":"finetune/infer_example.py","file_url":"https://github.com/xijia-tao/imgtrojan/blob/HEAD/finetune/infer_example.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"bb945d226af806a7"}},{"code_sha256_prefix":"c3ee9d07c900dd55","entry":"load_image_from_base64","repo":"xijia-tao/imgtrojan","repo_kind":"official","path":"finetune/llava/mm_utils.py","file_url":"https://github.com/xijia-tao/imgtrojan/blob/HEAD/finetune/llava/mm_utils.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c3ee9d07c900dd55"}},{"code_sha256_prefix":"9560e3e3e41bc1b2","entry":"precook","repo":"xijia-tao/imgtrojan","repo_kind":"official","path":"evaluation/caption_accur_metric/script/cider_scorer.py","file_url":"https://github.com/xijia-tao/imgtrojan/blob/HEAD/evaluation/caption_accur_metric/script/cider_scorer.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9560e3e3e41bc1b2"}},{"code_sha256_prefix":"37899f22fb191b37","entry":"pretty_print_semaphore","repo":"xijia-tao/imgtrojan","repo_kind":"official","path":"finetune/llava/utils.py","file_url":"https://github.com/xijia-tao/imgtrojan/blob/HEAD/finetune/llava/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"37899f22fb191b37"}},{"code_sha256_prefix":"344dff4791fd1381","entry":"process_images","repo":"xijia-tao/imgtrojan","repo_kind":"official","path":"finetune/llava/mm_utils.py","file_url":"https://github.com/xijia-tao/imgtrojan/blob/HEAD/finetune/llava/mm_utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"344dff4791fd1381"}},{"code_sha256_prefix":"f9939a84b9a65279","entry":"violates_moderation","repo":"xijia-tao/imgtrojan","repo_kind":"official","path":"finetune/llava/utils.py","file_url":"https://github.com/xijia-tao/imgtrojan/blob/HEAD/finetune/llava/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f9939a84b9a65279"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}